Class: Msf::Ui::Console::CommandDispatcher::Payload

Inherits:
Object
  • Object
show all
Includes:
ModuleCommandDispatcher, ModuleOptionTabCompletion
Defined in:
lib/msf/ui/console/command_dispatcher/payload.rb

Overview

Payload module command dispatcher.

Constant Summary collapse

@@supported_formats =

Load supported formats

Msf::Simple::Buffer.transform_formats + \
Msf::Util::EXE.to_executable_fmt_formats
@@to_handler_opts = 
Rex::Parser::Arguments.new(
  '-h' => [ false, 'Show this message' ]
)
@@generate_opts = 
Rex::Parser::Arguments.new(
  '-p' => [ true, 'The platform of the payload' ],
  '-n' => [ true, 'Prepend a nopsled of [length] size on to the payload' ],
  '-f' => [ true, "Output format: #{@@supported_formats.join(',')}" ],
  '-E' => [ false, 'Force encoding' ],
  '-e' => [ true, 'The encoder to use' ],
  '-P' => [ true, 'Total desired payload size, auto-produce appropriate NOP sled length'],
  '-S' => [ true, 'The new section name to use when generating (large) Windows binaries'],
  '-b' => [ true, "The list of characters to avoid example: '\\x00\\xff'" ],
  '-i' => [ true, 'The number of times to encode the payload' ],
  '-x' => [ true, 'Specify a custom executable file to use as a template' ],
  '-k' => [ false, 'Preserve the template behavior and inject the payload as a new thread' ],
  '-o' => [ true, 'The output file name (otherwise stdout)' ],
  '-O' => [ true, "Deprecated: alias for the '-o' option" ],
  '-v' => [ false, 'Verbose output (display stage in addition to stager)' ],
  '-h' => [ false, 'Show this message' ]
)

Instance Attribute Summary

Attributes included from Msf::Ui::Console::CommandDispatcher

#driver

Attributes included from Rex::Ui::Text::DispatcherShell::CommandDispatcher

#shell, #tab_complete_items

Instance Method Summary collapse

Methods included from ModuleOptionTabCompletion

#option_values_actions, #option_values_dispatch, #option_values_encoders, #option_values_nops, #option_values_payloads, #option_values_sessions, #option_values_target_addrs, #option_values_target_ports, #option_values_targets, #tab_complete_datastore_names, #tab_complete_module_datastore_names, #tab_complete_option, #tab_complete_option_names, #tab_complete_option_values, #tab_complete_source_interface

Methods included from ModuleCommandDispatcher

#check_multiple, #check_progress, #check_show_progress, #check_simple, #cmd_check, #cmd_check_help, #cmd_reload, #cmd_reload_help, #mod, #mod=, #reload, #report_vuln

Methods included from ModuleArgumentParsing

#append_datastore_option, #parse_check_opts, #parse_exploit_opts, #parse_opts, #parse_run_opts, #print_module_run_or_check_usage, #quote_whitespaced_value, #resembles_datastore_assignment?, #resembles_rhost_value?

Methods included from Msf::Ui::Console::CommandDispatcher

#active_module, #active_module=, #active_session, #active_session=, #build_range_array, #docs_dir, #framework, #initialize, #load_config, #log_error, #remove_lines

Methods included from Rex::Ui::Text::DispatcherShell::CommandDispatcher

#cmd_help, #cmd_help_help, #cmd_help_tabs, #deprecated_cmd, #deprecated_commands, #deprecated_help, #docs_dir, #help_to_s, included, #initialize, #print, #print_error, #print_good, #print_line, #print_status, #print_warning, #tab_complete_directory, #tab_complete_filenames, #tab_complete_generic, #tab_complete_source_address, #unknown_command, #update_prompt

Instance Method Details

#cmd_generate(*args) ⇒ Object

Generates a payload.



147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 147

def cmd_generate(*args)
  # Parse the arguments
  encoder_name = nil
  sled_size = nil
  pad_nops = nil
  sec_name = nil
  option_str = nil
  badchars = nil
  format = 'ruby'
  ofile = nil
  iter = 1
  force = nil
  template = nil
  plat = nil
  keep = false
  verbose = false
  mod_with_opts = mod.replicant

  @@generate_opts.parse(args) do |opt, _idx, val|
    case opt
    when '-b'
      badchars = Rex::Text.dehex(val)
    when '-e'
      encoder_name = val
    when '-E'
      force = true
    when '-n'
      sled_size = val.to_i
    when '-P'
      pad_nops = val.to_i
    when '-S'
      sec_name = val
    when '-f'
      format = val
    when '-o'
      if val.include?('=')
        print_error("The -o parameter of 'generate' is now preferred to indicate the output file, like with msfvenom\n")
        option_str = val
      else
        ofile = val
      end
    when '-O'
      print("Usage of the '-O' parameter is deprecated, prefer '-o' to indicate the output file")
      ofile = val
    when '-i'
      iter = val
    when '-k'
      keep = true
    when '-p'
      plat = val
    when '-x'
      template = val
    when '-v'
      verbose = true
    when '-h'
      cmd_generate_help
      return false
    else
      unless val.include?('=')
        cmd_generate_help
        return false
      end

      mod_with_opts.datastore.import_options_from_s(val)
    end
  end
  if encoder_name.nil? && mod_with_opts.datastore['ENCODER']
    encoder_name = mod_with_opts.datastore['ENCODER']
  end

  # Generate the payload
  begin
    buf = mod_with_opts.generate_simple(
      'BadChars' => badchars,
      'Encoder' => encoder_name,
      'Format' => format,
      'NopSledSize' => sled_size,
      'PadNops' => pad_nops,
      'SecName' => sec_name,
      'OptionStr' => option_str,
      'ForceEncode' => force,
      'Template' => template,
      'Platform' => plat,
      'KeepTemplateWorking' => keep,
      'Iterations' => iter,
      'Verbose' => verbose
    )
  rescue StandardError
    log_error("Payload generation failed: #{$ERROR_INFO}")
    return false
  end

  if !ofile
    # Display generated payload
    puts(buf)
  else
    print_status("Writing #{buf.length} bytes to #{ofile}...")
    f = File.expand_path(ofile)
    fd = File.open(f, 'wb')
    fd.write(buf)
    fd.close
  end
  true
end

#cmd_generate_help ⇒ Object 



135
136
137
138
139
140
141
142
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 135

def cmd_generate_help
  print_line 'Usage: generate [options]'
  print_line
  print_line 'Generates a payload. Datastore options may be supplied after normal options.'
  print_line
  print_line 'Example: generate -f python LHOST=127.0.0.1'
  print @@generate_opts.usage
end

#cmd_generate_tabs(str, words) ⇒ Object

Tab completion for the generate command



255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 255

def cmd_generate_tabs(str, words)
  fmt = {
    '-b' => [ true ],
    '-E' => [ nil ],
    '-e' => [ framework.encoders.module_refnames ],
    '-h' => [ nil ],
    '-o' => [ :file ],
    '-P' => [ true ],
    '-S' => [ true ],
    '-f' => [ @@supported_formats ],
    '-p' => [ true ],
    '-k' => [ nil ],
    '-x' => [ :file ],
    '-i' => [ true ],
    '-v' => [ nil ]
  }
  flags = tab_complete_generic(fmt, str, words)
  options = tab_complete_option(active_module, str, words)
  flags + options
end

#cmd_to_handler(*args) ⇒ Object Also known as: cmd_exploit 



63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 63

def cmd_to_handler(*args)
  if args.include?('-r') || args.include?('--reload-libs')
    driver.run_single('reload_lib -a')
  end

  mod_with_opts = mod.replicant
  handler = framework.modules.create('exploit/multi/handler')
  handler.share_datastore(mod_with_opts.datastore)

  @@to_handler_opts.parse(args) do |opt, _idx, val|
    case opt
    when '-h'
      cmd_to_handler_help
      return false
    else
      unless val.include?('=')
        cmd_to_handler_help
        return false
      end

      handler.datastore.import_options_from_s(val)
    end
  end

  handler_opts = {
    'Payload' => mod.refname,
    'LocalInput' => driver.input,
    'LocalOutput' => driver.output,
    'RunAsJob' => true,
    'Options' => {
      'ExitOnSession' => false
    }
  }

  replicant_handler = nil
  handler.exploit_simple(handler_opts) do |yielded_replicant_handler|
    replicant_handler = yielded_replicant_handler
  end

  if replicant_handler.nil?
    print_error('Failed to run module')
    return
  end

  if replicant_handler.error.nil?
    job_id = handler.job_id

    print_status "Payload Handler Started as Job #{job_id}"
  end
end

#cmd_to_handler_help ⇒ Object 



52
53
54
55
56
57
58
59
60
61
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 52

def cmd_to_handler_help
  print_line 'Usage: to_handler [options]'
  print_line
  print_line 'Creates a handler a payload. Datastore options may be supplied after normal options.'
  print_line 'This is convenient way of using multi/handler, setting the payload, and then setting datastore options.'
  print_line
  print_line 'Example: to_handler'
  print_line 'Example: to_handler LHOST=192.168.123.1'
  print @@to_handler_opts.usage
end

#cmd_to_handler_tabs(str, words) ⇒ Object

Tab completion for the generate command



119
120
121
122
123
124
125
126
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 119

def cmd_to_handler_tabs(str, words)
  fmt = {
    '-h' => [ nil ],
  }
  flags = tab_complete_generic(fmt, str, words)
  options = tab_complete_option(active_module, str, words)
  flags + options
end

#commands ⇒ Object

Returns the hash of commands specific to payload modules.



44
45
46
47
48
49
50
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 44

def commands
  super.update(
    'generate' => 'Generates a payload',
    'to_handler' => 'Creates a handler with the specified payload',
    'exploit' => 'Creates a handler with the specified payload'
  )
end

#name ⇒ Object

Returns the command dispatcher name.



131
132
133
 
# File 'lib/msf/ui/console/command_dispatcher/payload.rb', line 131

def name
  'Payload'
end